Regression: array_map(null, $array) identity form broken — TypeError/fatal (ext/standard/array.c)

[PurHur]

Category

stdlib

Problem

Zend treats array_map(null, $array) as the single-array identity form: it returns a copy of $array without invoking a callback. This compiler mis-parses the null callback and raises TypeError: array_map(): Argument #2 ($array) must be of type array, null given (or fatals with no output) — a regression of closed #4539.

php-src reference

• ext/standard/array.c — php_array_map() null-callback branch (ZEND_FCI_INITIALIZED guard)
• Tests: ext/standard/tests/array/array_map_variation*.phpt

Repro

Create test/repro/maintainer_gap_array_map_null.php:

<?php
$out = array_map(null, [1, 2, 3]);
echo implode(',', $out), "\n";

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && php bin/vm.php test/repro/maintainer_gap_array_map_null.php'
php test/repro/maintainer_gap_array_map_null.php

Zend:

1,2,3

This compiler (VM, 2026-06-17):

PHP Fatal error: Uncaught TypeError: array_map(): Argument #2 ($array) must be of type array, null given

(or empty output when wrapped in other calls)

Multi-array zip must remain unchanged:

<?php
var_export(array_map(null, [1,2], ['a','b'])); // Zend: array([0]=>array(1,'a'), ...)

Scope (this repo)

Area	Path	Action
Stdlib	ext/standard/array_map.php	Detect null callback + exactly one array → identity copy
VM	builtin dispatch	No special case in lib/VM.php — fix builtin
JIT	lib/JIT/Builtin/ array_map lowering	Mirror PHP guard when JIT supports array_map

PHP-in-PHP: implement in ext/standard/array_map.php; shared guard for JIT if lowered.

Done when (php-src-strict)

• php bin/vm.php test/repro/maintainer_gap_array_map_null.php prints 1,2,3
• Multi-array array_map(null, ...) still zips per Zend
• Compliance guard under test/compliance/cases/stdlib/array_map_null_identity.phpt
• JIT/AOT identity form green if array_map is JIT-supported in build

Verification

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && vendor/bin/phpunit --filter array_map_null'

Related

• Regression of closed Stdlib: array_map() — null zip + variadic source arrays (ext/standard/array.c php_array_map parity) #4539
• Callback parity: Stdlib: array_find / array_any / array_all / array_find_key — JIT/AOT Closure callbacks (ext/standard/array.c parity) #4009

[PurHur]

claim: PHP Compiler STD Lib — starting this run

[PurHur]

Unclaiming: array_map(null, [1,2,3]) works in isolation on master; issue repro fails in implode(',', array_map(...)) due to nested-call arg ordering (implode receives array as separator). That is a compiler call-site bug, not array_map null-callback semantics. Switching to #9141 phpversion Core.

[PurHur]

claim: worker-lane-c — starting this run

[PurHur]

claim: cursor-agent-lane-c — starting this run (nested inline call arg ordering for array_map(null, …) in implode)

[PurHur]

Merged via #15810

Root cause: nested inline Array_ hoists for array_map(null, [[1],[2]]) excluded the leading ConstFetch null from precedingInlineCallArgProducersBeforeCfgOp, so arg #0 was misbound to an inner array slot.

Fix: arrayMapNullCallbackProducerBeforeCfgCall() walks backward from the consumer through nested array preludes to the hoisted null callback; adjacent-nested resolution skips array_map arg #0 when that producer exists.

Verification:

• php bin/vm.php test/repro/maintainer_gap_array_map_null_nested_inline.php → ok
• Docker PHPUnit: array_map_null_nested_inline.phpt, array_map_null.phpt → green

[PurHur]

Merged fix in #15812.

Problem: #15810 fixed array_map(null, [[1],[2]]) but regressed multi-array null zip and closure zip — both haystacks bound to the trailing inline array.

Fix: In matchInlineCallArgProducer(), map 3+ arg array_map() array operands via matchInlineArrayProducersToArrayCallArgs before inlineHoistedProducerForCallArgIndex slot indexing.

Verification:

• php bin/vm.php test/repro/maintainer_gap_array_map_null_nested_inline.php → ok
• vendor/bin/phpunit --filter array_map_null → OK (8/8)
• ./script/ci-fast.sh → exit 0